VoIP security best practices come down to a few controls: accept SIP only from known IP addresses, use long unique credentials, keep the PBX and SBC patched, encrypt signalling and media where you can, and cap what each trunk can spend. Most losses on SIP trunks come from toll fraud through a weak account, not from broken encryption.
What are the main VoIP security risks?
The main VoIP security risks for a business or carrier are financial, not just privacy. Ranked by how often they cost money:
| Threat | What happens | Main defence |
|---|---|---|
| Toll fraud | Someone uses your PBX or trunk to place expensive calls | IP authentication, call limits, alerts |
| Revenue share fraud | Calls are pushed to high-cost numbers that pay the attacker | Destination blocking, spend caps |
| Registration scanning | Bots try thousands of extension and password pairs | Firewall rules, rate limiting, fail2ban-style bans |
| Denial of service | SIP floods make the server reject real calls | SBC, rate limits, upstream filtering |
| Eavesdropping | Unencrypted calls are captured on the network path | TLS for SIP, SRTP for media |
| Caller ID spoofing | Fraudsters impersonate your numbers to your customers | STIR/SHAKEN where available, number monitoring |
The attack pattern behind the first two is described in toll fraud and PBX hacking and IRSF.
How do you secure a SIP trunk?
Secure a SIP trunk by limiting who can send traffic to it and what that traffic can do. A practical checklist:
- Use IP authentication between your platform and your carrier. Accept and send traffic only from the agreed signalling IPs, as set up in a normal SIP interconnect.
- If you must register with a password, use a long random one per trunk and per extension, never the extension number or a default.
- Add a technical prefix or account tag agreed with the carrier, so stray traffic from an allowed IP is not billed to you by mistake.
- Restrict destinations. Allow only the countries you call. Block premium-rate and satellite ranges unless you need them.
- Set channel and CPS limits on each trunk so a compromise cannot fill hundreds of channels at once. See VoIP channels and CPS.
- Cap spending. Daily credit limits on prepaid accounts turn a disaster into a small loss.
What SIP trunk firewall rules should you use?
The basic SIP trunk firewall rule is deny by default: open SIP ports (5060 UDP/TCP, 5061 for TLS) only to your carrier's signalling IPs and your own users' networks, and open the RTP port range only as far as your media needs. Then:
- Do not expose the PBX web admin panel to the internet. Reach it over a VPN.
- Ban IPs automatically after repeated failed registrations.
- Drop SIP requests with known scanner user agents, but do not rely on this alone.
- Put a session border controller at the edge if you run a carrier or multi-tenant platform: it hides the internal topology, normalizes SIP and absorbs floods.
- Turn off SIP ALG on routers in front of the PBX. It causes audio problems and adds nothing to security.
Should VoIP calls be encrypted?
Yes, wherever both sides support it. Use TLS for SIP signalling and SRTP for the voice itself, especially for remote users on public networks. Be realistic about wholesale routes: many carrier interconnects still run plain SIP and RTP over dedicated links or IP whitelists, and encryption usually ends at the first carrier hand-off. Encryption protects call content; it does not stop toll fraud, which needs the controls above.
How do you detect a VoIP attack early?
Most fraud is visible in call records within minutes, so monitoring is the strongest single control. Watch for:
- Calls outside business hours, especially at night and on weekends.
- New destinations you never call, or bursts to one country or number range.
- Many short calls, or many parallel calls from one extension.
- A sudden jump in spend per hour against your normal baseline.
Alert on these patterns and block automatically above a threshold. Route monitoring with CDRs explains which fields to track, and carriers use a fraud management system to do it at scale. Keep patching: many PBX compromises use known flaws in old software versions.
Security when buying wholesale routes
When you buy wholesale VoIP termination, agree IP authentication, destination limits and credit limits with the provider from day one, and keep contact details for fraud alerts up to date. VoIPMatcher sources and manages the route for you, so these settings are part of the setup. Request a VoIP route and tell us which destinations and limits you need.
Frequently asked questions
Is VoIP secure?
VoIP can be as secure as traditional telephony, but only if it is configured carefully. The protocol itself is not the weak point in most incidents: weak passwords, open SIP ports, unpatched PBX software and missing call limits are. With IP restrictions, encryption and spending caps, the risk drops sharply.
What port does SIP use?
SIP uses port 5060 for UDP and TCP by default, and port 5061 for SIP over TLS. Media (RTP) uses a range of high UDP ports set on the PBX or SBC. Moving SIP to another port cuts noise from automated scans, but it is not real protection: firewall rules and authentication still do the work.
Should I disable SIP ALG on my router?
In most cases, yes. SIP ALG is a router feature that rewrites SIP messages, and many implementations do it badly, causing one-way audio, failed registrations and dropped calls. VoIP providers usually advise turning it off and handling NAT on the PBX or session border controller instead.
Can a SIP trunk be hacked?
Yes. Attackers scan the internet for SIP endpoints, guess extension passwords and then place expensive international calls, usually at night or on weekends. The SIP trunk is rarely broken itself: the attacker gets in through the PBX or a weak account and uses the trunk. IP authentication and call limits stop most of these attacks.
What are the biggest VoIP security threats?
The most common are toll fraud through hacked PBX accounts, international revenue share fraud, denial of service against SIP servers, eavesdropping on unencrypted calls, and caller ID spoofing aimed at your customers. Toll fraud is the one that costs businesses money fastest, often thousands within a few hours.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.